<?php if (!defined('DASHBOARD_ROOT')) define('DASHBOARD_ROOT', realpath(__DIR__ . '/../..')); require_once DASHBOARD_ROOT . '/api/bootstrap.php'; header('Content-Type: application/json'); if ($_SERVER['REQUEST_METHOD'] !== 'POST') { exit(json_encode(['success' => false, 'error' => 'POST required'])); } CSRF::enforce(); RBAC::enforce('modify.content'); $rowsJson = $_POST['rows'] ?? ''; $rows = json_decode($rowsJson, true); if (!is_array($rows)) { exit(json_encode(['success' => false, 'error' => 'Invalid rows data'])); } foreach ($rows as $r) { $id = (int)($r['id'] ?? 0); $order = (int)($r['order'] ?? 0); if ($id > 0) { Database::execute("UPDATE storefront_rows SET row_order = :o WHERE id = :id", [':o' => $order, ':id' => $id]); } } exit(json_encode(['success' => true])); 